CAP Cloud Security Architecture 3 — Questions and Answers
Question 1: In a multi-tenant cloud environment, which threat involves one tenant accessing another tenant's data or resources?
- Insider threat
- Side-channel attack
- Tenant isolation breach (Correct answer)
- Data remanence
Correct answer: Tenant isolation breach
A tenant isolation breach occurs when logical or physical boundaries between tenants fail, allowing unauthorized cross-tenant data access.
Question 2: Which NIST publication provides a cloud computing definition and identifies five essential characteristics of cloud computing?
- NIST SP 800-53
- NIST SP 800-145 (Correct answer)
- NIST SP 800-137
- NIST SP 800-171
Correct answer: NIST SP 800-145
NIST SP 800-145 defines cloud computing and its five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.
Question 3: What is 'data remanence' in the context of cloud decommissioning?
- Latency caused by geographic data distribution
- Residual data remaining on storage media after deletion (Correct answer)
- Automatic data backup to secondary regions
- Encryption key expiration after workload termination
Correct answer: Residual data remaining on storage media after deletion
Data remanence refers to residual data that persists on storage media after deletion, posing a risk when cloud storage is reallocated to other tenants.
Question 4: Which access control model is most suitable for enforcing attribute-based policies in cloud environments?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC) (Correct answer)
Correct answer: Attribute-Based Access Control (ABAC)
ABAC evaluates attributes of users, resources, and environment to make access decisions, making it highly flexible for dynamic cloud policies.
Question 5: A company wants to ensure its SaaS vendor meets baseline security requirements. Which document formalizes these security expectations?
- Memorandum of Understanding (MOU)
- Service Level Agreement (SLA)
- Security requirements annex or cloud security addendum (Correct answer)
- Business Impact Analysis (BIA)
Correct answer: Security requirements annex or cloud security addendum
A security requirements annex or cloud security addendum formally documents and enforces the specific security controls expected from a SaaS vendor.
Question 6: Which cloud security concept ensures that encryption keys are never exposed to the cloud provider in plaintext?
- Key escrow
- Bring Your Own Key (BYOK) (Correct answer)
- Key wrapping with provider keys
- Key rotation policy
Correct answer: Bring Your Own Key (BYOK)
BYOK allows customers to generate and manage their own encryption keys, ensuring the cloud provider never has access to the plaintext key material.
Question 7: In zero trust architecture applied to cloud environments, what principle replaces implicit network trust?
- Perimeter-based firewall rules
- Continuous verification and least privilege access (Correct answer)
- Static IP allowlisting
- VPN-only access policies
Correct answer: Continuous verification and least privilege access
Zero trust replaces implicit network trust with continuous verification of identity, device health, and least-privilege access regardless of network location.
CAP Cloud Security Architecture 3
In a multi-tenant cloud environment, which threat involves one tenant accessing another tenant's data or resources?